I think the concern in this scenario, with the lackadaisical approach to security, is that the router itself could then be easily compromised once network access is gained, which means all manner of MITM sort of attack vectors become possible from setting up interface mirroring to capture all interesting traffic to certificate forgery to capture encrypted payloads.
Yes, that's not even hard to do and I know of somebody who had their bank account compromised using "Hospital guest wifi" (my guess is that it was somebody transmitting the same SSID) where they unwittingly were redirected to a site setup to look just like their bank site and, since they weren't paying attention to the URL, plugged in their info.
Yeah, this isn't your typical script kiddie attack vector for sure, and DNS redirection (using legit certs) is far more likely, but it's certainly possible if somebody has teamed up with a foreign state actor (China/Russia) and part of a "hacking group" associated with them (I'm thinking pawn, not main player here, get the device compromised and on a botnet and then it's accessible to more competent operatives).
